Access Control Bypass in Gogs Open Source Git Service
CVE-2026-25232
Key Information:
Badges
What is CVE-2026-25232?
Gogs, a self-hosted Git service, has a significant access control bypass vulnerability present in versions 0.13.4 and earlier. This issue allows any collaborator with Write permissions to delete protected branches, including the default branch, by sending a direct POST request. The vulnerability arises because the deletion operation through the web interface circumvents the branch protection mechanism, which is otherwise enforced by Git Hooks during SSH pushes. As a result, low-privilege users can escalate their access levels to perform actions typically reserved for administrators. To mitigate this risk, users must upgrade to version 0.14.1, which addresses this vulnerability.
Affected Version(s)
gogs < 0.14.1
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.